The assessment of risks is the first step towards the adoption of appropriate security measures for the protection of personal data. Within the next steps we present a simplified approach that can guide the SMEs through their specific data processing operation and help them evaluate the relevant security risks.